full-disclosure - Re: THC SSL DOS tool released

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4EA59E64.3090704@extendedsubset.com>
Date: Mon, 24 Oct 2011 12:20:36 -0500
From: Marsh Ray <marsh@...endedsubset.com>
To: rm@...fault.net
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: THC SSL DOS tool released

On 10/24/2011 09:14 AM, rm@...fault.net wrote:
>
> Our tests reveal that the average server can be taken down from a
> single IBM laptop through a standard DSL connection.
>
> Taking on larger server farms who make use of SSL Load balancer
> required 20 average size laptops and about 120kbit/sec of traffic.
>
> All in all superb results.

Thanks for releasing the tool.

Anyone who cared enough to think about it would know that the basic idea
was possible. From time to time people would rediscover various angles
on the SSL DoS and for various reasons not go through with publishing
the tool. This meant hard data was lacking and many folks who depend on
the technology are insufficiently aware of their exposure.

In your source I see "Ask THC for the private release of the tool". Do
you have a different or interesting attack there?

> Interesting here is that a security feature that was supposed to make
> SSL Renegotiation was invented to renegotiate the key material of an
> SSL connection. This feature is rarely used. In fact we could not
> find any software that uses SSL Renegotiation.

Tor uses renegotiation. Connections that use client certificates that
don't want to send the client's certificate in-the-clear use
renegotiation. E.g., smart cards used for web auth.

> Yet it's enabled by default by most servers.

It may be important to distinguish between server-initiated
renegotiation and client-initiated (or attacker-initiated) renegotiation
here. In practice, MS IIS and Schannel-based servers don't accept
client-initiated renego but Apache/OpenSSL does.

Personally, I'd like to save renegotiation and keep it from going the
way of IP source routing (which was presumably once useful to someone).
If shallow-inspecting firewalls start shooting down all renegotiations,
it will probably only break a minority of apps. But minority-share apps
can be important and that hardly seems fair.

> An old saying comes true all over again: Complexity is the enemy of
> security.
>
> "Renegotiating Key material is a stupid idea from a cryptography
> standpoint. If you are not happy with the key material negotiated at
> the start of the session then the session should be re-established
> and not re-negotiated", says THC.

Like most things in mature complex systems like SSL, it depends on the
gory details.

- Marsh

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/